kfcpmexc[.]one

This domain, kfcpmexc.one, presents a high-risk brand impersonation threat specifically targeting users of the MEXC cryptocurrency exchange platform. Analysis indicates the site replicates MEXC's interface, including page titles and visual design elements, to deceive visitors into initiating unauthorized cryptocurrency transactions or disclosing sensitive account credentials. The primary attack vector appears to be crypto asset theft through fraudulent exchange interfaces, potentially enabling wallet-draining attacks against unsuspecting users. Technical evidence confirms the malicious nature of this infrastructure. The domain is flagged by 15 out of 95 security vendors on VirusTotal, indicating widespread detection across multiple threat intelligence platforms. Registered through Gname.com Pte. Ltd. on April 15, 2026, the domain resolves to IP address 137.220.131.177 and appears on three distinct security blocklists. Notably, the creation date suggests either a typographical error in registration records or potential domain squatting for future malicious campaigns. The domain has been actively blocked by cryptocurrency security tools and browser extensions specializing in phishing protection. Users who have visited kfcpmexc.one should immediately take several security measures. First, disconnect any crypto wallets that may have interacted with the site and revoke all connected dApp authorizations through wallet settings. Monitor all linked exchange accounts for unauthorized transactions and enable enhanced security features such as two-factor authentication. Consider rotating credentials for any accounts where login information may have been entered. The domain's current offline status does not eliminate risk, as threat actors may reactivate similar infrastructure. Users should verify all future MEXC-related communications through official channels only, paying particular attention to domain names and SSL certificate validity.